SignalHunt
← All rules

WIN-1002

high

RDP Brute Force Attempt

Detects a burst of failed logons (EventID 4625) with LogonType 10 (RemoteInteractive) against a single account from a single source IP - classic RDP password spraying, usually against internet-facing jump boxes or RDP gateways.

T1110.001T1021.001

Detection logic

{
  "detection_type": "threshold",
  "selection": {
    "EventID": 4625,
    "LogonType": 10
  },
  "groupby": "IpAddress",
  "timeframe_minutes": 5,
  "threshold": 8,
  "condition": "gte"
}

Log source: product=windows, service=security · Event ID(s): 4625

Required log fields

  • TargetUserName
  • IpAddress
  • LogonType
  • WorkstationName

Enabling this in your environment

Where: Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Logon/Logoff > Audit Logon (Success and Failure) 

auditpol /set /subcategory:"Logon" /success:enable /failure:enable

Same subcategory as WIN-1001. Confirm the RDP host's Windows Firewall / NLA settings aren't swallowing pre-auth attempts, and that the log source is actually the RDP target host, not just a jump-box's own login.

False positives

  • Legitimate users behind a corporate VPN/NAT hitting the same jump box

References